www.itafeitoparavoce.gq
Open in
urlscan Pro
35.231.109.134
Malicious Activity!
Public Scan
Submission: On March 15 via automatic, source openphish
Summary
This is the only time www.itafeitoparavoce.gq was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 35.231.109.134 35.231.109.134 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 151.139.237.113 151.139.237.113 | 54104 (AS-STACKPATH) (AS-STACKPATH - netDNA) | |
1 | 108.161.189.121 108.161.189.121 | 54104 (AS-STACKPATH) (AS-STACKPATH - netDNA) | |
2 | 172.217.16.170 172.217.16.170 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 172.217.22.67 172.217.22.67 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
11 | 5 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 134.109.231.35.bc.googleusercontent.com
www.itafeitoparavoce.gq |
ASN54104 (AS-STACKPATH - netDNA, US)
maxcdn.bootstrapcdn.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f170.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s17-in-f67.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
itafeitoparavoce.gq
www.itafeitoparavoce.gq |
53 KB |
2 |
gstatic.com
fonts.gstatic.com |
21 KB |
2 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
11 KB |
1 |
jquery.com
code.jquery.com |
38 KB |
11 | 5 |
Domain | Requested by | |
---|---|---|
5 | www.itafeitoparavoce.gq |
www.itafeitoparavoce.gq
code.jquery.com |
2 | fonts.gstatic.com |
code.jquery.com
|
2 | fonts.googleapis.com |
www.itafeitoparavoce.gq
|
1 | maxcdn.bootstrapcdn.com |
www.itafeitoparavoce.gq
|
1 | code.jquery.com |
www.itafeitoparavoce.gq
|
11 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://www.itafeitoparavoce.gq/un/mobi_IIIIII_erro.php
Frame ID: 330A0AAEC26D6D13C9533643C32A13A
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Ubuntu (Operating Systems) Expand
Detected patterns
- headers server /Ubuntu/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Twitter Bootstrap () Expand
Detected patterns
- script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
mobi_IIIIII_erro.php
www.itafeitoparavoce.gq/un/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
desco.css
www.itafeitoparavoce.gq/un/css/ |
111 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.1.min.js
code.jquery.com/ |
94 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/ |
34 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
icon
fonts.googleapis.com/ |
574 B 476 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
4 KB 695 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.itafeitoparavoce.gq/un/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
one.png
www.itafeitoparavoce.gq/un/img/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fail.png
www.itafeitoparavoce.gq/un/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v18/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v18/ |
10 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| jQuery11110107761527582182160 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
www.itafeitoparavoce.gq
108.161.189.121
151.139.237.113
172.217.16.170
172.217.22.67
35.231.109.134
0cbeef1cf3fbe7e0874802b1cb90e875f3bdbd49e2473bf73bd0efc1f2abac1d
107b6c97d3244d2421ab217986b57557deb50736b2e315fdcf939cdd8d3acb53
1b92762446049fa322f654c6b27d0f105962762616b8913f8545692d2e22dcca
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
484081bfe6c76d77610eb71a6e71206fe5304d62c037f058b403592192069306
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
8c0c01e348f1abe614d8df4758a594cb13a68d48154a04932d76dacc09a6e814
9ec2c4f9d69df38605bc4e3c04d18fbb25e04b3a5a6c7ca64cd3ea4670527886
c9cb17133e48ab718b3337d75ced921592134fccd75a30f0924bd57bd2d3df13
cba1997deaab2fae9f71ccf36d47b03ccb2c764f29aebbc5adfda18428fd6c84